(L1) Ensure external participants can't give or request control

Contributed by jeremy finneyAll contributors →

Part of CIS · Teams · Meetings · All checks

Run this check

Invoke-Maester -TestId CIS.M365.8.5.7

Overview

Giving or requesting control lets a participant take over the screen or a shared application of another participant. If external participants can do this, a guest from another organization can gain control of a presenter’s desktop or content during a meeting.

Turning this off means external participants can’t give or request control of shared content. External participants who are allowed to present can still share their own screen, which the Who can present setting controls. Control of your organization’s shared screens stays with participants from your organization.

Remediation action

1. Sign in to the Microsoft Teams admin center.
2. Go to Meetings > Meeting policies.
3. Open the Global (Org-wide default) policy.
4. Under External participants can give or request control, select Off.
5. Select Save.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command:

Set-CsTeamsMeetingPolicy -Identity Global -AllowExternalParticipantGiveRequestControl $false

Related links

• Microsoft Teams admin center
• Manage meeting policies in Microsoft Teams
• Set-CsTeamsMeetingPolicy
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.5.7

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.8.5.7
Severity	Medium
Suite	CIS
Product	Teams
Feature	Meetings
Area	External access and sharing
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1219 Remote Access Tools
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.5.7
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:8.5.7, nist-800-53-r5:AC-3
PowerShell test	Test-MtCisTeamsExternalControl
Services	Teams

Source

• Test: tests/cis/Test.CIS.M365.8.5.7.ps1
• Documentation: tests/cis/Test.CIS.M365.8.5.7.md